SonicWall has patched CVE-2026-19868, an authentication enforcement flaw in the SonicOS SSL VPN service that lets a user with valid credentials for another login method bypass SAML authentication and the multi-factor checks tied to it. CISA added the flaw to its Known Exploited Vulnerabilities catalog the same day the advisory appeared.
SonicWall Confirms Investigation of Possible CVE-2026-19868 Exploitation
SonicWall said its product security team “investigated a report indicating potential exploitation” of the vulnerability. Neither the company nor CISA has published details about the attacks or the actors behind them, and it remains unclear whether the flaw was exploited as a zero-day before the patch shipped.
The flaw only matters on firewalls where SAML-based login is enabled on the SSL VPN. On those devices, an attacker who holds valid credentials for an alternate authentication method can skip the SAML controls, and with them any MFA enforced through SAML. Ryan Harris of The Electronic Office reported the issue. SonicWall has described no workarounds, so patching is the only listed remedy.
How the SAML Authentication Bypass Weakens SSL VPN Logins
The vulnerability sits in how SonicOS enforces authentication policy rather than in the SAML protocol itself. A user authenticating through a different method than the one the administrator intended can sidestep the SAML path, which is where multi-factor prompts are typically enforced. Scoring differs across reports: one places the CVSS score at 7.1, while a second score of 7.5 also circulated in coverage of the CISA listing.
The practical effect is that a stolen or reused password for an alternate method can become a full VPN login on a firewall that administrators believe is protected by MFA. That makes the flaw relevant to organizations that rely on SAML identity providers to gate remote access.
Affected SonicOS Versions and Fixed Releases
SonicWall lists the affected products by generation. Gen7 TZ, NSa, NSsp and NSv firewalls running SonicOS 7.3.3-7015 or older are vulnerable, as are Gen8 TZ, NSa and NSv models on 8.2.2-8015 or older. The fixes arrive in SonicOS 7.3.4-7013 and 8.2.3-8015, and SonicWall urged customers to upgrade immediately.
Six Other Flaws Fixed in the Same SonicWall Advisory
The advisory covers seven vulnerabilities in total, and CVE-2026-19868 is the only one marked as exploited. Two carry CVSS scores of 8.8 and affect the management interface: one involves a permissive cross-domain policy and the other a session validation bug. Three more are pre-authentication buffer overflows in the SSL VPN and in the TACACS+ client, and they can cause denial of service. The last is a weak password hashing issue in virtual appliances.
This advisory is separate from the end-of-life Global Management System flaws SonicWall disclosed earlier in the week, CVE-2026-109593 and CVE-2026-109594.
CISA Sets a November 20 Federal Deadline Under BOD 26-04
CISA added the flaw to the KEV catalog on November 6 and gave federal civilian agencies until November 20 to apply the fix under Binding Operational Directive 26-04. KEV listings signal that CISA has evidence of exploitation, even when the agency publishes no technical detail, which is the situation here.
Why SSL VPN Appliances Keep Appearing in KEV Listings
Remote-access gateways sit at the network edge and hold the credentials that decide who gets in. An MFA bypass on such a device is valuable to attackers because it removes the control that blunts credential theft. The pattern is not new: edge security appliances have featured repeatedly in exploited-vulnerability catalogs over the past several years, and a flaw that defeats MFA rather than crashing a service is among the more useful ones for intruders who already hold passwords.
The missing attack details leave open how many organizations were targeted, and whether the report that triggered SonicWall’s investigation came from a customer incident or from outside research. Until SonicWall or CISA adds detail, defenders running SAML-enabled SSL VPNs on the affected Gen7 and Gen8 builds have only the version numbers and the vendor’s patch to work from.
